From owner-freebsd-ipfw@FreeBSD.ORG Fri Mar 28 21:27:29 2008 Return-Path: Delivered-To: freebsd-ipfw@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 458D7106566C for ; Fri, 28 Mar 2008 21:27:29 +0000 (UTC) (envelope-from jay@jcornwall.me.uk) Received: from vps1.jcornwall.me.uk (vps1.jcornwall.me.uk [193.227.111.74]) by mx1.freebsd.org (Postfix) with ESMTP id 09D968FC1E for ; Fri, 28 Mar 2008 21:27:28 +0000 (UTC) (envelope-from jay@jcornwall.me.uk) Received: from [82.70.152.17] (82-70-152-17.dsl.in-addr.zen.co.uk [82.70.152.17]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by vps1.jcornwall.me.uk (Postfix) with ESMTP id D0953520037 for ; Fri, 28 Mar 2008 21:27:27 +0000 (GMT) Message-ID: <47ED62BF.4070100@jcornwall.me.uk> Date: Fri, 28 Mar 2008 21:27:27 +0000 From: "Jay L. T. Cornwall" User-Agent: Thunderbird 2.0.0.12 (X11/20080227) MIME-Version: 1.0 To: freebsd-ipfw@freebsd.org References: <47ED2C79.5080601@jcornwall.me.uk> <200803281118.20653.fjwcash@gmail.com> In-Reply-To: <200803281118.20653.fjwcash@gmail.com> X-Enigmail-Version: 0.95.0 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: IPFW / if_bridge / NAT X-BeenThere: freebsd-ipfw@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: IPFW Technical Discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 28 Mar 2008 21:27:29 -0000 Freddie Cash wrote: >> This seemed to NAT packets outbound correctly, but the replies were >> never NAT'd back to the private IPs. I believe the presence of the >> bridge affects ipfw's ability to divert the appropriate packets. This >> configuration partly works: >> divert natd any from 192.168.1.0/24 to any >> divert natd any from any to > Have you tried restricting your rules to only the vr1 interfaces, with > configured directly on vr1: > > divert natd ip from 192.168.1.0/24 to any out xmit vr1 > divert natd ip from any to in recv vr1 Ah, there are recv/xmit semantics as well as in/out. I need to read the man page more thoroughly! However, this doesn't seem to work. It has the same symptoms as a single 'any to any via vr1' diversion: outbound packets are rewritten correctly (verified at the destination) but the replies are never rewritten. 00601 3 180 divert 8668 ip from 192.168.1.0/24 to any out xmit vr1 00602 0 0 divert 8668 ip from any to in recv vr1 Nothing ever reaches the second rule. I think the bridge changes ipfw filtering properties, because the simple 'any to any via vr1' is mentioned a lot in the literature. It just doesn't work here? -- Jay L. T. Cornwall http://www.jcornwall.me.uk/